| name | PO.1.3_po13 |
| description | Communicate requirements to all third parties who will provide commercial software components to the organization for reuse by the organization’s o... |
| category | configuration |
| version | 1.1 |
| author | cyberstrike-official |
| tags | ["nist","sp800-218","ssdf","po-1-3","po","secure-development","task"] |
| tech_stack | ["any"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | ["Define Security Requirements for Software Development (PO.1)"] |
| severity_boost | {} |
PO.1.3 PO.1.3
Task of practice: Define Security Requirements for Software Development (PO.1)
High-Level Description
Practice Group: Prepare the Organization (PO)
Framework: NIST SP 800-218 SSDF v1.1
Communicate requirements to all third parties who will provide commercial software components to the organization for reuse by the organization’s own software. .Formerly PW.3.1
What to Check
How to Test
Step 1: Review SDLC Documentation
Examine development lifecycle documentation for evidence of PO.1.3 practice implementation.
Step 2: Verify Tooling
# Check CI/CD pipeline configuration
# Verify security tools are integrated
# Example: Check for SAST/DAST in pipeline
grep -r "security\|scan\|sast\|dast" .github/workflows/ 2>/dev/null
grep -r "security\|scan" Jenkinsfile 2>/dev/null
Step 3: Assess Developer Awareness
Verify development team understands and follows PO.1.3 PO.1.3 practice.
Tools
| Tool | Purpose | Usage |
|---|
| github-security-mcp | Check repository security settings | github_security_* tools |
| Manual Review | SDLC process review | Documentation and interviews |
Remediation Guide
Implement PO.1.3 PO.1.3 in the software development lifecycle:
Communicate requirements to all third parties who will provide commercial software components to the organization for reuse by the organization’s own software. .Formerly PW.3.1
Risk Assessment
| Finding | Severity | Impact |
|---|
| PO.1.3 PO.1.3 not implemented | Medium | Secure Development - Prepare the Organization |
CWE Categories
